prizmkit 1.1.154 → 1.1.156

package/bundled/skills/app-planner/references/rules/backend/question-bank.md

@@ -11,14 +11,14 @@
 1. **Group order**: G1 → G2 → G3 → G4 → G5 → G6 → G7 → G8 → G9. Do not skip.
 2. **Shortcut commands** (respond immediately when user types these at any point):
    - `recommended` / `default` → skip current group, adopt all recommended options
-   - `all recommended` / `one-click` → skip all remaining groups, adopt all recommended options
+   - `all recommended` / `one-click` → explicit authorization to adopt each remaining applicable recommended option; ask any question whose recommendation is ambiguous for the selected stack
    - `strict` / `strictest` → adopt the strictest option for the current group
    - `skip` / `don't need this` → mark current group as N/A, note in output that "project does not require this yet"
    - `custom: xxx` → record user's custom content, do not match against options
 3. **Abbreviation recognition**: `A` / `a` / `1` all mean option A. `A,C` means multi-select (only for multi-select questions).
 4. **Follow-up rule**: If the user gives an answer outside the options (e.g., "I use Astro"), first confirm whether to classify as an "other" branch of an existing option before continuing.
 5. **Forbidden behaviors**:
-   - Must not make choices for the user before they explicitly answer.
+   - Must not make choices for the user before they explicitly answer, except concrete defaults covered by the user's explicit Quick/all-recommended authorization.
    - Must not fabricate user preferences to complete the answer set.
    - Must not output more than 3 questions in a single message.
 
@@ -100,7 +100,7 @@ Total: 20 questions.
 - **Maps to**: `{{ api_style }}` + `{{ api_rules }}`
 
 ### Q6. API Documentation
-- **Conditional logic**: If Q5 = GraphQL, auto-select B and skip Q6. If Q5 = gRPC, auto-select C and skip Q6. If Q5 = REST + gRPC hybrid, ask but note that REST endpoints default to A. Only ask Q6 directly when Q5 = RESTful.
+- **Conditional logic**: If Q5 = GraphQL, auto-select B and skip Q6. If Q5 = gRPC, auto-select C and skip Q6. Ask Q6 when Q5 = RESTful or REST + gRPC hybrid; for the hybrid, the answer governs the REST surface while Protobuf remains authoritative for gRPC.
 - **Options**:
   - A) OpenAPI/Swagger auto-generated **【Recommended for REST projects】**
   - B) GraphQL Schema (self-documenting) — auto-selected when Q5 = GraphQL
@@ -138,11 +138,11 @@ Total: 20 questions.
 
 ### Q9. Authentication Scheme
 - **Options**:
-  - A) JWT (stateless, suitable for APIs/microservices) **【Recommended】**
-  - B) OAuth2 + OIDC (third-party login/SSO)
-  - C) Session + Cookie (traditional web apps)
-  - D) API Key (service-to-service)
-- **Note**: Determines middleware selection and token management rules.
+  - A) JWT bearer tokens **【Recommended only for stateless API access with an explicit issuance, expiry, rotation, revocation, and audience model】**
+  - B) OAuth2 + OIDC **【Recommended for third-party login/SSO】**
+  - C) Server session + secure cookie **【Recommended for first-party browser applications】**
+  - D) API key or workload identity **【Recommended for constrained service-to-service access】**
+- **Note**: Determines identity, credential storage, revocation, middleware, and transport rules. There is no universal Quick default; infer from a confirmed client/trust model or ask.
 - **Maps to**: `{{ auth_scheme }}` + `{{ auth_rules }}`
 
 ---
@@ -151,20 +151,20 @@ Total: 20 questions.
 
 ### Q10. Caching
 - **Options**:
-  - A) Redis **【Recommended】**
+  - A) Redis **【Recommended when a shared/distributed cache or Redis capability is established】**
   - B) Memcached
   - C) In-memory cache (single instance only)
-  - D) No caching needed
-- **Note**: Determines cache key conventions, expiry strategy, and penetration/avalanche protection rules.
+  - D) No caching needed **【Recommended until a measured cache use case exists】**
+- **Note**: Determines cache key, expiry, invalidation, and failure behavior. Quick mode must not add cache infrastructure solely because a cache option exists.
 - **Maps to**: `{{ cache }}` + `{{ cache_rules }}`
 
 ### Q11. Message Queue
 - **Options**:
-  - A) RabbitMQ
-  - B) Kafka **【Recommended: high-throughput/event sourcing】**
-  - C) Redis Stream/BullMQ (lightweight task queues)
-  - D) No message queue needed
-- **Note**: Determines async processing, idempotency, and retry strategy rules. B is the default recommendation for most projects. Choose C only for lightweight task needs.
+  - A) RabbitMQ **【Recommended for brokered work queues/routing requirements】**
+  - B) Kafka **【Recommended for confirmed high-throughput event streams or durable replay】**
+  - C) Redis Stream/BullMQ **【Recommended for an existing Redis-backed lightweight task need】**
+  - D) No message queue needed **【Recommended until an asynchronous delivery requirement exists】**
+- **Note**: Determines async processing, delivery semantics, idempotency, and retry behavior. Quick mode never provisions messaging without a confirmed workload.
 - **Maps to**: `{{ mq }}` + `{{ mq_rules }}`
 
 ### Q12. Containerization & Deployment
@@ -197,7 +197,7 @@ Total: 20 questions.
   - For Rust: A) Built-in test **【Recommended】** — B) proptest
 - **Maps to**: `{{ test_framework }}`
 
-### Q15. Mock Strategy
+### Q15. Mock Strategy (only ask if Q13 ≠ D)
 - **Options**:
   - A) Mock all external deps, use testcontainers or in-memory DB for database **【Recommended】**
   - B) Mock all external deps including database
@@ -211,18 +211,18 @@ Total: 20 questions.
 
 ### Q16. Logging
 - **Options**:
-  - A) Structured JSON logging + centralized collection (ELK/Loki) **【Recommended】**
-  - B) Structured logging + local files
-  - C) Simple text logs, good enough
-- **Note**: Determines log format and field specifications.
+  - A) Structured event logging + selected centralized collection **【Recommended for multi-instance production services】**
+  - B) Structured logging to the deployment's standard stream/file collector **【Recommended for small or platform-managed deployments】**
+  - C) Simple text logs (development-only)
+- **Note**: Determines log format and collection boundary without forcing one observability vendor.
 - **Maps to**: `{{ logging }}` + `{{ observability_rules }}`
 
 ### Q17. Monitoring & Tracing
 - **Options**:
-  - A) OpenTelemetry + Prometheus + Grafana **【Recommended】**
-  - B) Health check endpoints + system monitoring only
-  - C) Not needed yet
-- **Note**: Determines instrumentation and alerting rules.
+  - A) OpenTelemetry plus compatible metrics/visualization **【Recommended when distributed tracing or a managed telemetry pipeline is required】**
+  - B) Health/readiness signals + deployment monitoring **【Recommended baseline for a small service】**
+  - C) Not needed yet (explicit development risk acceptance)
+- **Note**: Determines instrumentation and alerting rules; it does not make one vendor stack universal.
 - **Maps to**: `{{ monitoring }}` + `{{ observability_rules }}`
 
 ---

package/bundled/skills/app-planner/references/rules/backend/question-manifest.json

@@ -1,9 +1,18 @@
 {
-  "schema_version": "app-planner-question-manifest-v1",
+  "schema_version": "app-planner-question-manifest-v2",
   "layer": "backend",
   "total_questions": 20,
   "_doc": "Machine-readable structure for backend question-bank.md. Question TEXT/options/Recommended/Notes are authoritative in question-bank.md; this file carries ONLY structure: group membership, quick-mode, question->placeholder mapping, and conditional logic. Keep Qids and group ids in sync with question-bank.md. The AI reads this as its asking checklist (Phase A) and self-check expected-set (Phase D).",
-  "_conditions": "required_if / auto_derived_when use simple expressions over recorded answers, e.g. 'Q5 == RESTful', 'Q13 != D', 'Q5 in [GraphQL, gRPC]'. options_vary_by names a prior answer that changes the OPTION LIST only (question is still asked; never affects required).",
+  "_conditions": "required_if / auto_derived_when use option IDs over recorded answers, e.g. 'Q5 in [A, D]' and 'Q13 != D'. options_vary_by names a prior answer that changes the OPTION LIST only (question is still asked; never affects required).",
+  "render_contract": {
+    "fixed_rules_policy": "invariants_only",
+    "selected_decision_precedence": true,
+    "quick_mode_requires_explicit_authorization": true,
+    "unmapped_option_policy": "semantic_fallback",
+    "not_applicable_policy": "explicit_statement",
+    "conflict_policy": "fail_generation",
+    "semantic_fallback_questions": ["Q1", "Q2", "Q3", "Q4", "Q5", "Q6", "Q7", "Q8", "Q9", "Q10", "Q11", "Q12", "Q13", "Q14", "Q15", "Q16", "Q17", "Q18", "Q19", "Q20"]
+  },
   "groups": [
     { "id": "G1", "topic": "Language & Runtime", "quick_mode": true },
     { "id": "G2", "topic": "Framework & Architecture", "quick_mode": true },
@@ -18,19 +27,19 @@
   "questions": [
     { "id": "Q1", "group": "G1", "topic": "Programming Language", "maps_to": ["language", "tech_stack_rules"], "required": true },
     { "id": "Q2", "group": "G1", "topic": "Runtime Version", "maps_to": ["runtime_version"], "required": true },
-    { "id": "Q3", "group": "G2", "topic": "Web Framework", "maps_to": ["framework", "tech_stack_rules"], "required": true, "options_vary_by": "Q1", "note_open_ended_when": "Q1 == Custom" },
+    { "id": "Q3", "group": "G2", "topic": "Web Framework", "maps_to": ["framework", "tech_stack_rules"], "required": true, "options_vary_by": "Q1", "note_open_ended_when": "Q1 == F" },
     { "id": "Q4", "group": "G2", "topic": "Architecture Pattern", "maps_to": ["architecture", "arch_rules"], "required": true },
     { "id": "Q5", "group": "G3", "topic": "API Style", "maps_to": ["api_style", "api_rules"], "required": true },
-    { "id": "Q6", "group": "G3", "topic": "API Documentation", "maps_to": ["api_docs"], "required": true, "required_if": "Q5 == RESTful", "auto_derived_when": "Q5 in [GraphQL, gRPC]" },
-    { "id": "Q7", "group": "G4", "topic": "ORM / Data Access", "maps_to": ["orm", "data_rules"], "required": true, "options_vary_by": "Q1", "note_open_ended_when": "Q1 == Custom" },
-    { "id": "Q8", "group": "G4", "topic": "Database", "maps_to": ["database"], "required": true },
+    { "id": "Q6", "group": "G3", "topic": "API Documentation", "maps_to": ["api_docs", "api_rules"], "required": true, "required_if": "Q5 in [A, D]", "auto_derived_when": "Q5 in [B, C]" },
+    { "id": "Q7", "group": "G4", "topic": "ORM / Data Access", "maps_to": ["orm", "data_rules"], "required": true, "options_vary_by": "Q1", "note_open_ended_when": "Q1 == F" },
+    { "id": "Q8", "group": "G4", "topic": "Database", "maps_to": ["database", "data_rules"], "required": true },
     { "id": "Q9", "group": "G5", "topic": "Authentication Scheme", "maps_to": ["auth_scheme", "auth_rules"], "required": true },
     { "id": "Q10", "group": "G6", "topic": "Caching", "maps_to": ["cache", "cache_rules"], "required": true },
     { "id": "Q11", "group": "G6", "topic": "Message Queue", "maps_to": ["mq", "mq_rules"], "required": true },
     { "id": "Q12", "group": "G6", "topic": "Containerization & Deployment", "maps_to": ["container", "deploy_rules"], "required": true },
     { "id": "Q13", "group": "G7", "topic": "Test Coverage Requirements", "maps_to": ["test_requirement", "test_rules"], "required": true },
     { "id": "Q14", "group": "G7", "topic": "Test Framework", "maps_to": ["test_framework"], "required": true, "required_if": "Q13 != D", "options_vary_by": "Q1" },
-    { "id": "Q15", "group": "G7", "topic": "Mock Strategy", "maps_to": ["mock_strategy", "test_rules"], "required": true },
+    { "id": "Q15", "group": "G7", "topic": "Mock Strategy", "maps_to": ["mock_strategy", "test_rules"], "required": true, "required_if": "Q13 != D", "auto_derived_when": "Q13 == D" },
     { "id": "Q16", "group": "G8", "topic": "Logging", "maps_to": ["logging", "observability_rules"], "required": true },
     { "id": "Q17", "group": "G8", "topic": "Monitoring & Tracing", "maps_to": ["monitoring", "observability_rules"], "required": true },
     { "id": "Q18", "group": "G9", "topic": "AI Permission to Add Dependencies", "maps_to": ["ai_dependency_rule"], "required": true },

package/bundled/skills/app-planner/references/rules/backend/template.md

@@ -1,98 +1,87 @@
 # Backend Rules — {{ project_name }}
 
-> This document was generated by the `backend-rules` skill on {{ generated_at }}
-> Audience: All backend developers + all AI coding assistants on this project
->
-> **Usage**:
-> 1. All AI coding assistants must read this file before generating or modifying any backend code
-> 2. This document takes precedence over "general best practices" in AI training data
-> 3. Code conflicting with this document must not be committed
+> Generated by app-planner Rules Configuration
+> Audience: project contributors and AI coding assistants working on the backend
 
----
+This document contains confirmed decisions plus compatible invariant and derived rules. Unselected options are not active requirements.
 
-## 0. TL;DR — Key Decisions at a Glance
+## 1. Decision Ledger
 
-| Dimension | Decision |
-|-----------|----------|
+| Domain | Selected Decision |
+|---|---|
 | Language | {{ language }} |
-| Runtime Version | {{ runtime_version }} |
+| Runtime | {{ runtime_version }} |
 | Framework | {{ framework }} |
-| Architecture Pattern | {{ architecture }} |
-| API Style | {{ api_style }} |
-| API Documentation | {{ api_docs }} |
-| ORM | {{ orm }} |
+| Architecture | {{ architecture }} |
+| API style | {{ api_style }} |
+| API documentation | {{ api_docs }} |
+| Data access | {{ orm }} |
 | Database | {{ database }} |
 | Authentication | {{ auth_scheme }} |
-| Caching | {{ cache }} |
-| Message Queue | {{ mq }} |
-| Containerization | {{ container }} |
-| Test Requirements | {{ test_requirement }} |
-| Test Framework | {{ test_framework }} |
-| Mock Strategy | {{ mock_strategy }} |
+| Cache | {{ cache }} |
+| Message queue | {{ mq }} |
+| Deployment/container | {{ container }} |
+| Test depth | {{ test_requirement }} |
+| Test framework | {{ test_framework }} |
+| Mock strategy | {{ mock_strategy }} |
 | Logging | {{ logging }} |
-| Monitoring | {{ monitoring }} |
+| Monitoring/tracing | {{ monitoring }} |
 
----
+Deferred and not-applicable decisions remain explicit.
 
-## 1. Project Structure
+## 2. Structure and Stack
+
+### 2.1 Invariant ownership
 
 {{ FIXED_RULES_STRUCTURE }}
 
+### 2.2 Selected architecture
+
 {{ arch_rules }}
 
----
+### 2.3 Selected language, runtime, and framework
 
-## 2. API Design
+{{ tech_stack_rules }}
+
+## 3. API Contract
 
 {{ FIXED_RULES_API }}
 
 {{ api_rules }}
 
----
+HTTP-specific conventions apply only to selected HTTP surfaces. GraphQL and gRPC surfaces use their own active derivation rules.
 
-## 3. Error Handling
+## 4. Error and Security Boundaries
 
-{{ FIXED_RULES_ERROR }}
+### 4.1 Error integrity
 
----
+{{ FIXED_RULES_ERROR }}
 
-## 4. Security
+### 4.2 Security invariants and selected authentication
 
 {{ FIXED_RULES_SECURITY }}
 
 {{ auth_rules }}
 
-{{ FIXED_RULES_RATE_LIMITING }}
-
----
+### 4.3 Abuse protection
 
-## 5. Database
+{{ FIXED_RULES_RATE_LIMITING }}
 
-For schema design standards (normalization, column types, indexing, migration management), refer to `database-rules.md` (generated separately by the `database-rules` skill). This section covers backend-perspective database concerns only.
+## 5. Data Access
 
 {{ FIXED_RULES_DATABASE }}
 
 {{ data_rules }}
 
----
+Detailed datastore modeling rules, when separately configured by app-planner, live in `database-rules.md`. Shared decisions must agree; a mismatch blocks generation rather than creating two sources of truth.
 
-## 6. Observability
+## 6. Cache and Messaging
 
-{{ FIXED_RULES_OBSERVABILITY }}
+### 6.1 Cache
 
-{{ FIXED_RULES_TRACING }}
-
-{{ observability_rules }}
-
----
-
-## 7. Configuration Management
-
-{{ FIXED_RULES_CONFIG }}
-
----
+{{ cache_rules }}
 
-## 8. Async & Message Queues
+### 6.2 Async work and message delivery
 
 {{ FIXED_RULES_ASYNC }}
 
@@ -100,74 +89,67 @@ For schema design standards (normalization, column types, indexing, migration ma
 
 {{ mq_rules }}
 
----
+When cache or messaging is not selected, the corresponding section states that it is not applicable.
 
-## 8b. Graceful Shutdown
+## 7. Observability and Lifecycle
 
-{{ FIXED_RULES_GRACEFUL_SHUTDOWN }}
+### 7.1 Observability
 
----
+{{ FIXED_RULES_OBSERVABILITY }}
 
-## 9. Testing
+{{ FIXED_RULES_TRACING }}
 
-{{ FIXED_RULES_TEST }}
+{{ observability_rules }}
 
-{{ test_rules }}
+### 7.2 Configuration
 
----
+{{ FIXED_RULES_CONFIG }}
 
-## 10. AI Vibecoding Behavior Constraints
+### 7.3 Graceful shutdown
 
-### 10.1 Baseline Constraints (project-agnostic, always active)
+{{ FIXED_RULES_GRACEFUL_SHUTDOWN }}
 
-{{ FIXED_RULES_AI_BASE }}
+## 8. Testing
 
-### 10.2 Project-Specific Hard Constraints
+{{ FIXED_RULES_TEST }}
 
-- **Adding dependencies**: {{ ai_dependency_rule }}
-- **Modifying shared modules**: {{ ai_breaking_change_rule }}
-- **Modifying configuration**: {{ ai_config_rule }}
+{{ test_rules }}
 
-### 10.3 Mandatory Pre-Actions (before every code generation)
+Only test tiers and thresholds selected in the decision ledger are mandatory.
 
-AI must complete the following in order before generating or modifying any backend code:
+## 9. AI Change Permissions
 
-1. Read this file (`backend-rules.md`)
-2. Read existing files in the target module's directory to confirm whether similar functionality already exists
-3. If modifying shared utils / middleware / service, search all callers
-4. If modifying API contracts, assess impact on frontend/clients
+### 9.1 Invariant change safety
 
----
+{{ FIXED_RULES_AI_BASE }}
 
-## 11. Tech Stack Lock-in
+### 9.2 Selected permissions
 
-{{ tech_stack_rules }}
+- Dependency changes: {{ ai_dependency_rule }}
+- Shared-module impact analysis: {{ ai_breaking_change_rule }}
+- Configuration and environment changes: {{ ai_config_rule }}
 
----
+These selected blocks own their domains; no appendix or invariant may override them.
 
-## 12. Containerization & Deployment
+## 10. Deployment
 
 {{ deploy_rules }}
 
-## 13. Caching Strategy
-
-{{ cache_rules }}
-
----
-
-## Appendix A: Deny List (Quick Reference)
-
-> This appendix is auto-generated by AI in Phase 4 by extracting all forbidden entries from each section.
+## Appendix A: Active Deny List
 
 {{ deny_list_summary }}
 
-## Appendix B: Recommended Libraries & Tools
+Include only prohibitions from active invariant and selected blocks.
 
-> This appendix is auto-generated by AI in Phase 4 to recommend the supporting ecosystem based on the tech stack.
+## Appendix B: Compatible Recommendations
 
 {{ recommended_libs }}
 
----
+Recommendations must match the selected language, framework, data, deployment, and dependency-permission decisions.
+
+## Source Contract
 
-**Version**: v1.0 — Generated on {{ generated_at }}
-**Next review recommended**: before tech stack changes or infrastructure migrations
+- Owner: app-planner Rules Configuration
+- Resource family: `references/rules/backend/`
+- Regenerate after a decision or source-contract change.
+- Generation metadata value: {{ generated_at }}